Pass 3 for NES PowerPad Test Card (U): name all data tables and VramWrite streams

- Decoded the VramWrite ($E1CC) stream format: <addr hi> <addr lo> <count> <bytes>, $00 terminator
- Named all 9 payload streams ($E4CC-$E7C2, no gaps/overlaps) plus VramWriteSourcePointerTable at $F000
- Split PadBitTableLives into Player1TileTable ($E4B4) and Player2TileTable ($E4C0), 12 entries each (Y=0..11)
- Decoded CHR font (digits $30-$39, letters $3A-$52, space $5F; 'W' missing from the A-Z run)
  and recovered on-screen text including 'PRESS A TO TEST SIDE-A' / 'SIDE-B'
- Documented that the 16 KiB PRG is two byte-identical 8 KiB halves; $C000 copy is dead
- Documented 7 unreached subroutines inside the live code region (kept as .byte per Pass-1 policy)
- Fixed a stray duplicate sentence and stale _wip paths in root OVERVIEW.md

Byte-identical ROM verified.

_wip/MUSCLE (U)/copilot/linker.cfg

@@ -1,6 +1,10 @@
 MEMORY {
-  PRG: start = $C000, size = $4000, file = %O, fill = yes;
+  HEADER: start = $0000, size = $0010, fill = yes;
+  PRG:    start = $8000, size = $4000, file = %O, fill = yes;
+  CHR:    start = $0000, size = $2000, file = %O, fill = yes;
 }
 SEGMENTS {
-  PRG: load = PRG, type = ro;
-}
+  HEADER: load = HEADER, type = ro;
+  PRG:    load = PRG,    type = ro;
+  CHR:    load = CHR,    type = ro;
+}